Arbitrary Write To Rce

You've got an arbitrary write primitive from a heap bug, format string, or overflow, and now you need to turn it into code execution. This walks you through every major target: GOT entries if you have partial RELRO, malloc/free hooks if you're pre-glibc 2.34, IO_FILE vtable manipulation, exit_funcs with pointer mangling, and TLS_dtor_list for modern glibc. The version matrix is the most useful part here because base models love to suggest __free_hook on glibc 2.35 where it doesn't exist anymore. It covers the pointer guard demangling math and has trigger conditions for each target. This is genuinely the last mile skill, the "I can write anywhere, now what" reference.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill arbitrary-write-to-rce --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Arbitrary Write to Code Execution — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, __malloc_hook, __free_hook, _IO_FILE vtable, __exit_funcs, TLS_dtor_list, _dl_fini, modprobe_path, .fini_array, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post-glibc 2.34) or miss pointer mangling requirements.

0. RELATED ROUTING

heap-exploitation — obtaining the arbitrary write via heap attacks
format-string-exploitation — obtaining the arbitrary write via %n
stack-overflow-and-rop — stack-based write primitives
binary-protection-bypass — which targets are available given protection configuration
heap-exploitation IO_FILE_EXPLOITATION.md — deep _IO_FILE structure exploitation